Splunk Enterprise Security

Phantom: When running a Splunk action why the error "Failed to acquire lock"?

apollo_sj
New Member

Hi All,

We are running an Splunk action - run query (search) on a Phantom playbook which is active on every event coming on to phantom. However, at times the action - run query (search) fails with message: Failed to acquire lock named '08' for Action: 'run query', App: 'Splunk'. Failed to acquire the lock '08'. The action - run query (search) tries to execute for 30 minutes or so and eventually fails. Any help to troubleshoot this issue is highly appreciated.

 

Thanks in advance 🙂

 

Labels (2)
0 Karma

JH_1234
New Member

I had this issue today, and I had to go back through my phantom events, and there was a run query that had been running for 24 hours. I'm not sure why it didn't time out, but find when your error started happening and look at the phantom event right before it and see if there is an action that is stuck in a running state and terminate it.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...